interrogate
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided code diffs and intent descriptions, which are interpolated into templates for subagents in
references/reviewer-prompt.md.\n - Ingestion points: The
{INTENT}and{DIFF_OR_FILES}placeholders in the reviewer prompt template receive untrusted data from the user or the repository environment.\n - Boundary markers: The template uses markdown headers (
## Intent,## Code Under Review) as delimiters, but lacks explicit instructions for the models to ignore embedded directives within the user-provided content.\n - Capability inventory: While subagents are described as read-only, the skill suggests the ability to open Pull Requests (Step 3) to update configuration files, representing a potential write capability if the main agent is successfully influenced.\n
- Sanitization: There is no evidence of sanitization, escaping, or filtering of the content being reviewed before it is passed to the subagents.\n- [COMMAND_EXECUTION]: The skill executes local version control commands and suggests automated repository modifications.\n
- Evidence: Step 1 uses
git diffto gather context, and Step 3 mentions opening a separate PR to update configuration tables if agent resolution fails. These actions are consistent with the skill's intended purpose as a developer tool.
Audit Metadata